Data Protection Code Part 3: Monitoring At Work

The long-awaited Part 3 of the Data Protection Code on Employment Practices, dealing with Monitoring at Work, has been issued.

The four parts are:

Part 1 - Recruitment and Training (see bulletin 14/3/02)
Part 2 - Record Management (see bulletin 3/9/02)
Part 3 - Monitoring At Work (today)
Part 4 - Medical Records (forthcoming)

The Code is 55 pages long. The Supplementary Guidance is a further 49 pages - giving 104 pages in total. Helpfully, the key sections and summaries have been highlighted in a gray colour which does prevents printing and which makes them almost impossible to read on the screen.

In summary, the Code provides:

• employers can monitor workers when the advantage to the business outweighs the intrusion into the workers' affairs;
• employers should normally carry out an impact assessment before monitoring, weighing up the advantage v intrusion equation;
• workers should be told if they are being monitored;
• information discovered through monitoring should normally only be used for the purpose for which the monitoring was carried out;
• the information discovered should be kept secure, which may mean only letting one or two people have access to it
• employers should be careful when monitoring personal communications such as Emails which are clearly personal
• employers should not undertake covert monitoring except in the rarest circumstances where it is used for the prevention or detection of crime, it has been authorised at the highest level of the business, and where there is a risk that notifying workers of the monitoring would frustrate the purpose of the monitoring.
Why does that need 104 pages? Answers on a postcard, please.